For Leicester's space data, fashion and food manufacturing software teams. No day rates.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Leicester's economy still rests on making things. The city has a long textile and clothing industry, now closely tied to online fashion, and a large food manufacturing base. It also has a genuine space cluster: the University of Leicester's Space Park Leicester and the National Space Centre, with companies working on satellite data and Earth observation. Nearby, the Leicestershire stretch of the Midlands logistics corridor moves much of what gets made.
Each of these sectors meets a different buyer. Space data firms answer to investors, agencies and enterprise customers. Fashion platforms answer to brands and shoppers whose accounts and cards they hold. Food manufacturers answer to retailers. All of them increasingly ask for an accredited, independent test before they trust the software.
Companies selling satellite imagery, analytics and data services through web platforms and APIs need to protect paid datasets and customer accounts. Investors and agency customers expect independent testing as part of technical due diligence.
What we focus onAPI key scoping against subscription tiers, dataset and tile access controls, processing job submission, customer organisation separation, and server-side handling of uploaded geometry or file formats.
Online fashion sites and the platforms connecting brands with manufacturers hold shopper accounts, addresses and order histories. High order volumes and frequent promotions make them attractive targets for account takeover and discount abuse.
What we focus onBasket and pricing integrity, discount and gift card logic, account takeover defences, returns and refund flows, and supplier portals where manufacturers see brand orders and specifications.
Manufacturers increasingly take trade orders, share specifications and manage customer pricing through online portals. Retail and food service customers want assurance these portals cannot be used to alter orders or pricing.
What we focus onCustomer-specific price lists, trade account permissions, order amendment after confirmation, specification and allergen document access, and the integration endpoints linking the portal to production planning systems.
Across Leicester's data, fashion and food platforms, the issues we see most involve people getting more than they paid for or more than they should see.
Data platforms often check that a key is valid but not what it is entitled to. A basic subscriber can request premium datasets or higher resolution imagery simply by changing a parameter.
Shops that accept negative or fractional quantities can produce a lower total or a credit. Combined with discount codes, this can create orders that cost far less than the goods shipped.
B2B portals sometimes send the customer's price tier in the request. Changing it gives a small account the pricing reserved for a major customer, quietly eroding margins across many orders.
Shopper logins with no rate limiting or bot detection let attackers test leaked passwords at scale. Taken-over accounts are used for fraudulent orders with saved cards and addresses.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Space firms bidding for government work often hold Cyber Essentials Plus. It checks baseline controls; it does not test your application's logic. Many buyers ask for both.
Space and data start-ups raising funding are routinely asked for security evidence. A CREST report with retest results answers that request and avoids delays in the data room.
Fashion platforms process large volumes of personal data. Regular testing supports Article 32 obligations and shows the ICO you checked controls if an account takeover campaign occurs.
We agree limits before testing, such as how many processing jobs we may submit and at what size. We test job submission for authorisation and injection flaws using small requests, so customer workloads and your cloud costs are not affected in any meaningful way.
Before the promotion code is written into production, ideally in a staging environment with the sale rules configured. Discount stacking and pricing errors are business logic flaws, so we need the real promotion setup to find them. Testing afterwards only tells you what went wrong.
No, if you own and operate the portal you can authorise testing yourself. We use test accounts you create, not your customers' logins. If a customer's own systems integrate with the portal, those are out of scope unless they give permission.
No. CyberFortify has no Leicester office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
